From 33bb26c13a38357d944784a81dfb562f6038d5fd Mon Sep 17 00:00:00 2001
From: Reuel Albert <66895085+ReuelAlbert-Dev@users.noreply.github.com>
Date: Wed, 6 Aug 2025 12:32:21 +0800
Subject: [PATCH 1/4] Create python-app.yml

---
 .github/workflows/python-app.yml | 39 ++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 .github/workflows/python-app.yml

diff --git a/.github/workflows/python-app.yml b/.github/workflows/python-app.yml
new file mode 100644
index 000000000..1168bd9ad
--- /dev/null
+++ b/.github/workflows/python-app.yml
@@ -0,0 +1,39 @@
+# This workflow will install Python dependencies, run tests and lint with a single version of Python
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python
+
+name: Python application
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up Python 3.10
+      uses: actions/setup-python@v3
+      with:
+        python-version: "3.10"
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install flake8 pytest
+        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+    - name: Lint with flake8
+      run: |
+        # stop the build if there are Python syntax errors or undefined names
+        flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
+        # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
+        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
+    - name: Test with pytest
+      run: |
+        pytest

From f8f17b41fbf0f8f775cd0ed93173c5e1f8474ccb Mon Sep 17 00:00:00 2001
From: Reuel Albert <66895085+ReuelAlbert-Dev@users.noreply.github.com>
Date: Wed, 6 Aug 2025 12:35:21 +0800
Subject: [PATCH 2/4] Potential fix for code scanning alert no. 4: Workflow
 does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .github/workflows/publish-pypi.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 0d9eb2de0..1961c9c83 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -31,6 +31,8 @@ jobs:
           path: dist/
 
   checks:
+    permissions:
+      contents: read
     uses: ./.github/workflows/shared.yml
 
   pypi-publish:

From 63d8085ed2d86f43290797686b9652c44f47fe85 Mon Sep 17 00:00:00 2001
From: Reuel Albert <66895085+ReuelAlbert-Dev@users.noreply.github.com>
Date: Wed, 6 Aug 2025 12:40:21 +0800
Subject: [PATCH 3/4] Potential fix for code scanning alert no. 1: Workflow
 does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .github/workflows/publish-pypi.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 1961c9c83..f7272ea67 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -7,6 +7,8 @@ on:
 jobs:
   release-build:
     name: Build distribution
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     needs: [checks]
     steps:

From 1810eb9254302f9a5c1a6fd7192cbeb26e4b9520 Mon Sep 17 00:00:00 2001
From: Reuel Albert <66895085+ReuelAlbert-Dev@users.noreply.github.com>
Date: Wed, 6 Aug 2025 12:43:15 +0800
Subject: [PATCH 4/4] Create pyre.yml

---
 .github/workflows/pyre.yml | 46 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 .github/workflows/pyre.yml

diff --git a/.github/workflows/pyre.yml b/.github/workflows/pyre.yml
new file mode 100644
index 000000000..053f88a6f
--- /dev/null
+++ b/.github/workflows/pyre.yml
@@ -0,0 +1,46 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow integrates Pyre with GitHub's
+# Code Scanning feature.
+#
+# Pyre is a performant type checker for Python compliant with
+# PEP 484. Pyre can analyze codebases with millions of lines
+# of code incrementally – providing instantaneous feedback
+# to developers as they write code.
+#
+# See https://pyre-check.org
+
+name: Pyre
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+permissions:
+    contents: read
+
+jobs:
+  pyre:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: Run Pyre
+        uses: facebook/pyre-action@60697a7858f7cc8470d8cc494a3cf2ad6b06560d
+        with:
+          # To customize these inputs:
+          # See https://github.com/facebook/pyre-action#inputs
+          repo-directory: './'
+          requirements-path: 'requirements.txt'